twitchdev
No Cross Origin Resource Policy on the Extension JS Helper
Brief description
One of the upcoming CSP headers is Cross-Origin-Opener-Policy
It's not currently enabled on the JS Helper to allow it to be included.
This is only an issue if the Developer misconfigures their test. And if Twitch enables it on Hosted/release test and doesn't update the CDN the JS helper is served from as well.
How to reproduce
Enable Cross-Origin-Opener-Policy header on your extension test that provides a server to load content from and provides CSP headers.
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy
Screenshots
From the alert shown in the console when clicking on the twitchJS Helper in the network tools tab:
Additional context or questions
Generally this is only (currently) an issue for developers whom msiconfigure their test environements. As some libraries that provide CSP headers are changing their defaults
